Privacy policy

Gallop Post is an independent editorial publication at galloppost.com. It takes no bets, holds no wagering accounts and holds no reader funds, so it has no need for identity documents, payment details or anything else a wagering operator collects. What it does collect is a short list, and this page is that list. It was last read through against the code on 18 October 2026.

This policy is written to the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) made under it. Where a section below implements a particular principle, it says which one. Nothing here is a certification, an audit finding or a seal: this paper has none of those and does not claim any.

Personal information reaches this site in exactly four ways, and every one of them is a form you choose to send. There is no passive collection, no profile built from your reading, and no identifier assigned to you (APP 3: only what the form needs, and nothing sensitive).

Two more things are recorded that are not forms, and both are named here so the list is complete.

• Web server logs. The server that answers these pages writes the usual request log — address, time, page, status, browser string. It is operated by the hosting provider, kept for its own short rotation, and used only to keep the site up and to look at abuse. The desk does not read it to find out who read what.
• The contact form's browser string. The message row keeps the User-Agent your browser sent, cut to 180 characters, because a message that arrived mangled is usually a message from a browser that mangles forms.

This is the half of a privacy policy that usually goes unsaid, so it goes first here. None of the following exists on this site, on any page, in any state:

• No analytics. No Google Analytics, no Plausible, no Matomo, no self-hosted analytics, no server-side page counter tied to a reader.
• No trackers or pixels. No advertising pixel, no conversion tag, no remarketing list, no fingerprinting script of any kind.
• No ad network. Nothing on this site is sold as advertising inventory, so there is nothing for an ad network to be plugged into.
• No font CDN. Oswald, Source Sans 3 and IBM Plex Mono are self-hosted as woff2 files under /assets/fonts/ on this domain, and the stylesheet that declares them is ours. No request goes to Google Fonts, Adobe Fonts or any other font host, which means no third party is handed your address simply because you loaded a page.
• No third-party scripts, libraries or frames from elsewhere. The three scripts this site runs — main.js, search.js and theme.js — are files on this domain. The demo at /play/ is a self-contained bundle served from this domain that makes no outbound requests of its own.
• No social embeds. The share buttons under a story are plain links. No script from X or Facebook loads, and nothing is sent to either of them unless you click the link, at which point you are on their site under their terms.
• No comment platform. Comments are stored on this server by the code in this repository. There is no Disqus, no Facebook comments, no hosted moderation service.
• No mailing platform. Addresses sit in a file on this server. They are not uploaded to a campaign tool, a CRM or a list broker.
• No sensitive information. No date of birth, no identity document, no payment details, no location, no health, racial, political or religious information. There is no age gate, because there is nothing on this site to be of age for.
• Nothing is sold, rented, traded or hired to anyone, ever. There is no commercial arrangement under which that could happen.

You can check most of that yourself from the page you are reading. Open your browser's network panel and reload: every request should go to galloppost.com and nowhere else.

• One session cookie. PHP sets a session cookie when you first load a page. It holds a random identifier and nothing else. Its two jobs are to carry the one-time token that proves a form submission came from the form, and to keep you signed in if you have registered. It is not an analytics cookie, it does not follow you to another site, and it expires when your browser session ends.
• One localStorage key, gp-theme. When you press the light/dark button in the masthead, the choice is written to your browser's local storage as the word light or dark. That value never leaves your browser: it is not a cookie, so it is never sent to this server, and the desk cannot see it. Clear your site data and the site goes back to following your operating system's setting, with dark as the default.

There is nothing else. No third-party cookie can be set on this site because no third party is loaded by it, which is also why there is no cookie banner: a banner asking consent for cookies that do not exist is theatre, and this paper does not print theatre.

• Your newsletter address is used to send the circuit wrap, which goes out on Friday mornings and carries the week's results, the weightings that moved and anything the industry did worth reading about. It is used for nothing else. It is not added to any other list, and no other list exists.
• Your contact message is used to answer your message, and to act on it if it is a correction. Sending a message does not add you to the mailing list — the form says so above the button, and the code does not do it.
• Your registration is used to sign you in, to attribute your comments to your username, and to write to you about a comment if the desk needs to.
• Your comment is published with your username beside it once a person has read it. Your email address is never published and never shown to other readers.

Each form carries a short notice at the field itself saying what happens to what you type and linking here, which is what APP 5 asks for. If this paper ever wanted to use any of it for something not on this list, it would ask you first, in a message you could ignore without losing anything.

Pseudonymity (APP 2). Comments are attributed to the username you chose, not to your legal name, and the desk does not ask for a legal name at registration. Use a handle if you prefer; a correction is judged on whether it is right, not on who sent it.

Nobody, with two unavoidable exceptions that are named rather than hidden in a definition.

• The hosting provider operates the server the files sit on and can, in the nature of hosting, reach them. It is not given the data for any purpose of its own and does not process it on this paper's instructions beyond keeping the server running.
• A law enforcement or regulatory body making a lawful request, which the paper would answer only so far as the law requires, and would tell you about unless telling you were itself unlawful.

Cross-border disclosure (APP 8). There is no overseas mailing platform, no overseas comment host, no overseas analytics service and no content delivery network in front of this site, so your information is not disclosed to an overseas recipient by any of the ordinary routes. If that ever changed — if the paper took on a mailing service, for instance — this page would name the service and the country before the first address was sent to it.

• Submissions are written as one JSON line per row to append-only files under /storage/. The web server is configured to refuse every request for that directory and for any file ending in .jsonl, so the files are not reachable over the web even by name.
• Passwords are stored as a one-way hash produced by PHP's own password hashing. The password itself is never written to disk and cannot be recovered from the hash — which is also why a forgotten password is reset rather than retrieved.
• Pages are served over HTTPS. Forms post to the same origin and carry a one-time token, so a submission cannot be forged from another site.
• Access to the files is limited to the desk, which is a small number of people with a reason to be in there.
• No copy of any store is kept on a desk machine, a spreadsheet or a third-party service.

No site can promise that nothing will ever go wrong, and this page does not. If a breach occurred that was likely to cause serious harm, the paper would notify the affected readers and the Office of the Australian Information Commissioner, which is the scheme the Privacy Act sets up for exactly that.

The periods are in the table in section 1. The mechanism is worth a sentence, because the files are append-only: a deletion is not a row quietly disappearing, it is a person rewriting the file without that row, which happens on a weekly pass. Until that pass runs, a row you have asked to have removed is flagged and not used.

• Unsubscribing uses the link in every email, which works without signing in, and takes effect on the next send at the latest. One line to [email protected] does the same thing, and is the route to take if you signed up and would rather not wait for a wrap to arrive. A reader who unsubscribes is removed from everything, not from one list, because there is only one list.
• A comment you want taken down is taken down. Ask, and it goes; the paper does not require a reason.
• A registration is deleted on request, which deletes the username, the address and the hash. Comments already published can stay up anonymised, or go with it, whichever you ask for.
• Rows kept past their period for an active correction are named as such when you ask what is held.

Write to [email protected] from the address you used, or use the contact form with the subject Data request. Say which of the four things you are asking about — the mailing list, a message, a comment, a registration — because that is what the desk needs to find the row.

• Access. You get back what is held about you, as it is held: the actual rows, with the timestamps and the truncated IP. No charge.
• Correction. Anything wrong is corrected. If the paper disagrees that it is wrong, your statement goes on the record beside it, which is what APP 13 requires rather than an argument about who is right.
• Deletion. As set out in section 7.
• How long it takes. The desk's own commitment is five working days for most requests and 30 days at the outside. If it will take the full 30, you are told that inside the five.

Verification is deliberately light, because the desk holds nothing worth stealing: a reply from the address on the row is enough. The paper will not ask you for identity documents to prove you own an email address.

Complain to the desk at [email protected]. You get an acknowledgement inside five working days and an answer inside 30, in writing, saying what happened and what has been changed.

If that answer does not satisfy you, the complaint goes to the Office of the Australian Information Commissioner, the regulator for the Privacy Act, at oaic.gov.au. You do not need this paper's permission to go there and nothing on this page is a condition of doing so.

This is an editorial site about simulated racing. It takes no bets and offers nothing of value, so there is no age gate and no reason to collect an age. The demo on /play/ is not a gambling product: it runs on play credits, takes no payment and awards no prize.

The paper does not knowingly hold personal information about a child. If you are a parent or guardian and believe a registration or a comment here belongs to your child, write to [email protected] and it will be removed without an argument. The Privacy and Other Legislation Amendment Act 2024 (Cth) directed the OAIC to make a Children's Online Privacy Code; this page will be updated when that code is registered.

• Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles made under it, which is the framework every section above is written against.
• The small business threshold, stated plainly. The Privacy Act generally applies to organisations with an annual turnover above A$3 million. A new independent publication sits well under that, which means this paper is probably not an APP entity and is probably not legally bound by the principles at all. It complies anyway, voluntarily, and says so here rather than letting you assume an obligation that may not exist. Removal of the threshold has been flagged for a future reform tranche; nothing on this page would have to change if it went.
• Spam Act 2003 (Cth) for the newsletter. The three obligations that bite are consent, accurate sender identification and a working unsubscribe facility. Consent is what you gave by typing your address into the form — nothing is ever sent to an address that did not ask. Every email identifies Gallop Post as the sender, from this domain, and carries an unsubscribe link that works without signing in.
• Notifiable data breaches. Covered in section 6.

This page is reviewed whenever a form handler changes and at least once a year. When it changes in a way that affects what is collected or who sees it, the change is described at the top of the page rather than buried in a new revision date. The current version was read through on 18 October 2026.

Questions about anything above go to [email protected], which is the contact point for this policy. General enquiries go to [email protected].